83428108@qq.com 发表于 2013-6-14 19:45:41

关于DLL呼出窗体的问题

大家好,现在遇到一个问题.
DLL已经注入到目标进程,已经检查过进程内可执行模块,有我注入的DLL
但是无法呼出DLL窗口,连 MessageBox()都无法出来
library DllGame;
{ Important note about DLL memory management: ShareMem must be the
first unit in your library's USES clause AND your project's (select
Project-View Source) USES clause if your DLL exports any procedures or
functions that pass strings as parameters or function results. This
applies to all strings passed to and from your DLL--even those that
are nested in records and classes. ShareMem is the interface unit to
the BORLNDMM.DLL shared memory manager, which must be deployed along
with your DLL. To avoid using BORLNDMM.DLL, pass string information
using PChar or ShortString parameters. }
uses
SysUtils,windows,
Classes;
{$R *.res}
var
keyhhk: HHOOK ;
Function add (a,b:integer):integer; //加法函数
begin
result:=a+b;
end;
Function keyproc(icode,wp,lp:integer):DWORD;stdcall;   //键盘HOOK回调函数
begin
if (icode=HC_ACTION) then
            begin
            if (wp=VK_HOME)and ((1 shl 31)and lp=0) then MessageBox(0,'显示WG','显示WG',0);
            end;
keyProc:=CallNextHookEx(keyhhk,icode,wp,lp);
end;
Function installKeyProc():boolean;stdcall;
var
h:HWND;
GameTid:THandle;
begin
    Result:=false;
    h:=FindWindow(nil,'The Return of Legend');
    if h=0 then begin Messagebox(0,'未找到游戏','error',0);exit; end;//如果游戏未打开则退出
    GameTid:=GetWindowThreadProcessId(h);
    keyhhk:=SetWindowsHookEx(WH_KEYBOARD,@Keyproc,GetModuleHandle('DllGame.dll'),GameTid);
    if keyhhk>0 then Result:=true;
end;
exports   //导出函数
add,
installKeyProc;

哪位前辈给个例程,注入方式不管,只需要DLL部分,能在拦截键盘信息,呼出窗体就好

aminghanhua 发表于 2013-6-20 15:56:17

总感觉找窗口 不如找进程好 我也新手

本帖最后由 aminghanhua 于 2013-6-20 15:59 编辑

library DllGamePro;

{ Important note about DLL memory management: ShareMem must be the
first unit in your library's USES clause AND your project's (select
Project-View Source) USES clause if your DLL exports any procedures or
functions that pass strings as parameters or function results. This
applies to all strings passed to and from your DLL--even those that
are nested in records and classes. ShareMem is the interface unit to
the BORLNDMM.DLL shared memory manager, which must be deployed along
with your DLL. To avoid using BORLNDMM.DLL, pass string information
using PChar or ShortString parameters. }

uses
SysUtils,
Windows,
Classes,
TlHelp32,
DllGame in 'DllGame.pas' {ForMain},
Setfun in 'Setfun.pas',
GameFun in 'GameFun.pas';

{$R *.res}

var
keyhhk: HHOOK ;

Function keyproc(icode,wp,lp:integer):DWORD;stdcall;   //键盘HOOK回调函数
begin
if (icode=HC_ACTION) then
            begin
            if (wp=VK_HOME)and ((1 shl 31)and lp=0) then
            begin
             // MessageBox(0,'显示WG','显示WG',0);
             if form1=nil thenForm1:=Tform1.Create(nil);
                form1.Visible:=not form1.Visible;
            end;
            end;
keyProc:=CallNextHookEx(keyhhk,icode,wp,lp);
end;

function FindProcess(AFileName: string): boolean; //判断gc.exe是否存在
var
       hSnapshot:   THandle;//用于获得进程列表
       lppe:   TProcessEntry32;//用于查找进程
       Found:   Boolean;//用于判断进程遍历是否完成
   begin
       Result   :=False;
       hSnapshot   :=   CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,   0);//获得系统进程列表
       lppe.dwSize   :=   SizeOf(TProcessEntry32);//在调用Process32First   API之前,需要初始化lppe记录的大小
       Found   :=   Process32First(hSnapshot,   lppe);//将进程列表的第一个进程信息读入ppe记录中
       while   Found   do
       begin
       if   ((UpperCase(ExtractFileName(lppe.szExeFile))=UpperCase(AFileName))   or
         (UpperCase(lppe.szExeFile   )=UpperCase(AFileName)))
       then
       begin
         Result   :=True;
       end;
       Found   :=   Process32Next(hSnapshot,   lppe);//将进程列表的下一个进程信息读入lppe记录中
       end;
   end;


function GetProcessID(ProcessName:string):DWORD;//获取gc.exe进程ID
var
lppe: TProcessEntry32;
found : boolean;
Hand : THandle;
P:DWORD;
s:string;
begin
result:=0;
Hand := CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);
found := Process32First(Hand,lppe);
while found do
begin
    s := string(lppe.szExeFile);
    if lppe.th32ProcessID>0 then
      p := lppe.th32ProcessID
    else
      p := 0;
    if UpperCase(ExtractFileName(s))=UpperCase(ExtractFileName(ProcessName)) then
    begin
      result:=p;
      break;
    end;
    found := Process32Next(Hand,lppe);
end;
end;


Function installKeyProc():boolean;stdcall;
var
GameTid:THandle;
begin
    Result:=false;
               if not FindProcess('gc.exe') then
   Exit;//如果游戏未打开则退出
    GameTid:=GetProcessID('gc.exe');
    keyhhk:=SetWindowsHookEx(WH_KEYBOARD,@Keyproc,GetModuleHandle('DllGamePro.dll'),GameTid);
    if keyhhk>0 then Result:=true;
end;
procedure DllEnterProc(reason:integer);
begin
   case reason of
   windows.DLL_PROCESS_ATTACH: begin end;
   windows.DLL_PROCESS_DETACH: begin Form1.Free;form1:=nil; end;
   end;
end;


exports   //导出函数

installKeyProc;

begin
//Messagebox(0,'Loading','error',0);
dllProc:=@DllEnterProc;
end.
页: [1]
查看完整版本: 关于DLL呼出窗体的问题